EUVD-2026-52569
GHSA-75p7-jv3w-pjpc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
PR:H confirmed by admin-only CLI access; AV:N reflects remote management interface reachability; full C/I/A justified by arbitrary code execution on the firewall OS.
Primary rating from Vendor (Zyxel).
CVSS VectorVendor: Zyxel
Lifecycle Timeline
2DescriptionCVE.org
A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50(W) series firmware versions from V4.16 through V5.42 Patch 1, and USG20(W)-VPN series firmware versions from V4.16 through V5.42 Patch 1 could allow an authenticated attacker with administrator privileges to execute a crafted malicious configuration file on an affected device.
AnalysisAI
Path traversal in Zyxel's ZLD-based firewall firmware (ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN series) allows an authenticated administrator to supply a crafted configuration file path to the CLI execution command, bypassing directory restrictions and achieving arbitrary code execution on the device. All four product lines share the same vulnerable CLI mechanism across wide firmware version ranges, substantially broadening the attack surface for organizations running unpatched appliances. No public exploit or CISA KEV listing has been identified at time of analysis, limiting immediate real-world risk to scenarios involving credential compromise or insider threat.
Technical ContextAI
The vulnerability exists within the CLI command responsible for loading and executing configuration files on Zyxel ZLD (Zyxel Linux-based Daemon) firewall firmware. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates the CLI parser fails to adequately sanitize or canonicalize path components, permitting directory traversal sequences to reference files outside the intended configuration directory. CPE strings confirm four distinct firmware lines are affected: cpe:2.3:a:zyxel:atp_series_firmware (V4.32-V5.42 Patch 1), cpe:2.3:a:zyxel:usg_flex_series_firmware (V4.50-V5.42 Patch 1), cpe:2.3:a:zyxel:usg_flex_50(w)_series_firmware (V4.16-V5.42 Patch 1), and cpe:2.3:a:zyxel:usg20(w)-vpn_series_firmware (V4.16-V5.42 Patch 1). These are purpose-built network security appliances - stateful firewalls with VPN concentrator capabilities - where OS-level code execution represents a full device compromise, including potential interception of traversing traffic and VPN credential access.
RemediationAI
Apply the patched firmware available from Zyxel per the official advisory at https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-the-configuration-file-execution-cli-command-of-zld-firewalls-08-04-2026 - the exact fix version is not specified in the available data and must be confirmed directly from Zyxel's advisory page. As compensating controls prior to patching: restrict management interface access (SSH and HTTPS admin) to dedicated management VLANs or trusted jump hosts using firewall ACLs, preventing remote exploitation even if admin credentials are compromised; enforce multi-factor authentication for all administrator accounts where the platform supports it, raising the credential-compromise bar; and audit administrator account usage for anomalous configuration file operations. Note that restricting management network access is the highest-value control since it negates the AV:N attack vector entirely without any functional trade-off for standard operations.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today